show results from two splunk queries into one

Question

I have two separate splunk queries: 1st Query : Outputs unique user count in last 24 hours 2nd Query : Outputs unique users count in last 24 hours in geo = US

I want to create a timechart that will show , a line chart with % of user everyday from US.

How can this be achieved.

Answer 1

You can join the two queries by using :

|

So your query can look like this:

{firstQuery} as countUS| {secondQuery} as countTotal | eval perc=countUS/countTotal

Answer 2

You can use a conditional to count those from US

Example query:

index=data | timechart dc(user) as dc_user, dc(eval(if(geo=US,user,NULL))) as us_user | eval perc_us=round(us_user/dc_user*100,2) | table _time, perc_us

Alternatively you can use the SPL join command but that would be less efficient as it would have to read the data twice and join the results.